MALICIOUS — 40286139713.pdf

MALICIOUS — 40286139713.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: b92e2d7c757a8e77a3aaf731a2b68467080c1ae29a74dcb90a7adcc00d400aef
• SHA-1: 9a01b9dcd820a59d18bfcb448af2b91e2bf20db6
• MD5: 6dd4fff3ee93e8d1c6227c08daf9fadf
• ssdeep: 1536:uazsU5pKd9oi4PfTmbhGx0PwK2snWGpOKdWOPzusj4ScQ3jWeZ0JPshAHAUA:5PM7oiM78a8DBIKBj4S/RQHQ
• TLSH: T11338C0F32193DE9C73C69B836AB6129D704AC3C85166E7900488B73C897C9BEBF11951
• Submitted as: 40286139713.pdf
• File type: pdf · Size: 78412 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://allytemp.ru/uplcv?utm_term=dragon+ball+z+kai+subbed, http://collegium-connect.nl/ckupload/files/22015162037.pdf, http://abworder.com/uploads/files/13904608502.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://allytemp.ru/uplcv?utm_term=dragon+ball+z+kai+subbed
• http://collegium-connect.nl/ckupload/files/22015162037.pdf
• http://abworder.com/uploads/files/13904608502.pdf
• https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/1613144273d26a---bubipatavadafesepo.pdf
• http://thailaundry.com/imgUpload/files/jaredexelis.pdf
• https://gornjastubica.hr/files/22222595326.pdf
• http://diagonal.org.ar/wp-content/plugins/formcraft/file-upload/server/content/files/161341aa179f68---45716069777.pdf
• https://vitanov.rs/files/87619689475.pdf
• https://alakharia.com/public_html/userfiles/file/30507448555.pdf
• https://latarnik-kopice.pl/galeria/file/zonezubagafel.pdf
• https://threadworx.com/thread/admin/uploads/file/zoparidetetinaniwi.pdf
• http://www.brennholz-heinlein.de/wp-content/plugins/formcraft/file-upload/server/content/files/1612f1333edeca---46077144187.pdf
• http://prasongp.com/file_media/file_image/file/6729067078.pdf
• http://laureysnv.be/uploads/files/77646716664.pdf
• https://performanshost.com/calisma2/files/uploads/wilexutifi.pdf
• https://ijfbacknumber.com/editor_up/pofelokisizawerosuziku.pdf
• https://chuyennhakienvangvn.net/upload/files/tiruwemefaruruxovapafusix.pdf
• http://fobosgrunt.ru/files/ckfinder/files/64069441255.pdf
• https://siemreaptraveltours.com/userfiles/file/11282876.pdf
• https://luxurytravel-show.com/wp-content/plugins/super-forms/uploads/php/files/d0be09521f9a6f342eaa971e29f32fd9/88130064532.pdf
• http://sanarina.de/ckfinder/userfiles/files/zipuvosagowodij.pdf
• http://propack-th.com/image/upload/File/nekixapetupufolofetovuxib.pdf
• http://luligang.com/ckfinder/userfiles/files/19361127139.pdf
• https://novitas.ro/files/kebexuwuxiv.pdf
• http://80tner.friend-match.com/upload/files/10148110630.pdf

Embedded domains

• allytemp.ru
• collegium-connect.nl
• abworder.com
• www.hauptsache.cc
• thailaundry.com
• alakharia.com
• latarnik-kopice.pl
• threadworx.com
• www.brennholz-heinlein.de
• prasongp.com
• laureysnv.be
• performanshost.com
• ijfbacknumber.com
• chuyennhakienvangvn.net
• fobosgrunt.ru
• siemreaptraveltours.com
• luxurytravel-show.com
• sanarina.de
• propack-th.com
• luligang.com
• 80tner.friend-match.com
• www.w3.org
• purl.org
• ns.adobe.com
• gornjastubica.hr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report